2026-10-06 归档

今日共收录 1258 条安全情报，包含 460 个 CVE，421 篇安全通告，以及 100 篇研究论文。

漏洞预警2026-10-05 发布INFO

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data race that can cause the BuildKit daemon to panic.

CVE-2026-93319

A malicious external BuildKit frontend can send requests using the internal API that can create conditions for a data ra

历史摘要 · 未重新核验 · NVD

#cve #cwe-567

漏洞预警2026-10-05 发布INFO

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versions, BuildKit could use the advertised DiffIDs to derive c...

CVE-2026-93318

A malicious image can advertise DiffIDs from another image while containing different layer contents. In affected versio

历史摘要 · 未重新核验 · NVD

#cve #cwe-354

漏洞预警2026-10-05 发布INFO

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not match the claimed digest. The resulting snapshot could be c...

CVE-2026-93317

An unauthenticated attacker controlling a registry or OCI-layout blob source could provide blob contents that did not ma

历史摘要 · 未重新核验 · NVD

#cve #cwe-354

漏洞预警2026-10-05 发布INFO

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This can happen maliciously or by accident.

CVE-2026-93316

If BuildKit daemon is started with --cdi-disabled it can lead to daemon panic when builds try to use CDI devices. This c

历史摘要 · 未重新核验 · NVD

#cve #cwe-476

漏洞预警2026-10-05 发布INFO

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions. To li...

CVE-2026-78413

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do

历史摘要 · 未重新核验 · NVD

#cve #cwe-276

漏洞预警2026-10-05 发布INFO

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows a user with LABEL_CLIENTS permission to update the server...

CVE-2026-78411

Velociraptor's SetClientMetadata used the wrong permission check to enforce setting metadata on the server. This allows

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-05 发布INFO

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This iss...

CVE-2026-42700

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Sli

历史摘要 · 未重新核验 · NVD

#cve #cwe-79

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omits it from the database query. A proje...

CVE-2026-105633

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves to any project in that workspace inclu...

CVE-2026-105632

Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace mem

历史摘要 · 未重新核验 · NVD

#cve #cwe-284

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownloadEndpoint.get resolve FileAsset records within a workspa...

CVE-2026-105631

Plane is an open-source project management tool. Prior to 1.4.0, WorkspaceFileAssetEndpoint.get and WorkspaceAssetDownlo

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generi...

CVE-2026-105630

Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, includ

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-434 #cwe-616

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare primary-key lookup without workspace...

CVE-2026-105629

Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate

历史摘要 · 未重新核验 · NVD

#cve #cwe-639

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider user data through a server-side HTTP ...

CVE-2026-105628

Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avata

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-05 发布INFO

A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected by this vulnerability is an unknown functiona...

CVE-2026-105385

A vulnerability was determined in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-05 发布INFO

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Perform...

CVE-2026-105384

A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) withou...

CVE-2026-104979

Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes

历史摘要 · 未重新核验 · NVD

#cve #cwe-79 #cwe-862

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible to any authenticated user who knows the workspace slug an...

CVE-2026-104978

Plane is an open-source project management tool. Prior to 1.4.0, Plane's project invitation list endpoint is accessible

历史摘要 · 未重新核验 · NVD

#cve #cwe-863

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remai...

CVE-2026-104977

Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject hosts that resolve to private or internal...

CVE-2026-104976

Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and

历史摘要 · 未重新核验 · NVD

#cve #cwe-918

漏洞预警2026-10-05 发布INFO

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDOR...

CVE-2026-104975

Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/as

历史摘要 · 未重新核验 · NVD

#cve #cwe-639